CVE-2024-2113 describes a CSRF vulnerability in the Ninja Forms Contact Form Builder plugin for WordPress, affecting all versions up to and including 3.8.0. The issue arises from missing or incorrect nonce validation on the nf_download_all_subs AJAX action, which handles exporting form submissions. An attacker can exploit this by tricking an authenticated site administrator into performing an action (such as clicking a malicious link), causing an unauthorized export of form data to a location accessible publicly. This vulnerability does not require the attacker to have privileges beyond unauthenticated status but does require user interaction from an admin-level user.

The vulnerability allows unauthorized export of form submission data, potentially exposing sensitive user information collected via Ninja Forms. The impact is limited to confidentiality (partial data disclosure) with no integrity or availability impact. Exploitation requires user interaction by an administrator, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when clicking links and consider restricting access to the nf_download_all_subs AJAX action or implementing additional nonce validation manually if feasible. Monitoring for updates from the vendor kstover is recommended.